If you are in network operations, why not get a network trace to see what actually goes over the wire? Also consider the Mozilla Live Headers to see a lisg of HTTP requests being made. Most likely, the login information is being passed via cookie and you can simply request the "login frame" directly, just like your browwser does.